Cogs Subprocessors

The third parties that may process customer personal data to provide the service.

Cogs uses third parties to help provide the Service. A subprocessor is a provider that may process Customer Personal Data on Cogs' behalf. Some customer-selected integration providers may also act independently under their own terms for parts of their services.

Current Production / Launch Providers

Provider	Purpose	Typical data involved
Anthropic	Commercial/API AI processing	Prompts, transaction context, instructions, and outputs necessary for AI accounting features
Plaid	Customer-authorized financial connectivity	Financial-account metadata and transaction information authorized by the customer; Plaid handles the authentication flow and does not provide bank-login credentials to Cogs
Shopify	Customer-authorized commerce integration	Store, order, product, customer, payment/refund, tax, shipping, discount, and related commerce data authorized by the merchant
Supabase	Application database and authentication infrastructure	Account, authentication, application, and Customer Data stored or processed by Cogs
Railway	Application/backend hosting	Application traffic, logs, and Customer Data processed by hosted Cogs services
Cloudflare	DNS, network delivery, and security	IP address, request/network metadata, security events, and traffic routed through Cloudflare services
Resend	Transactional/service email delivery	Recipient email address, message metadata, and message content sent through the service
Google Workspace	Business email and customer communications	Contact information and message content sent to or from Cogs personnel

Publication condition: this table must match the actual production architecture. Engineering must remove any provider that is not used as described and add any production provider that processes Customer Personal Data before the page is published. In particular, any future analytics, error tracking, session replay, support, observability, or additional hosting provider must be reviewed for inclusion.

AI Data Practices

Cogs uses Anthropic commercial/API services. Anthropic's current commercial policy states that commercial inputs and outputs are not used to train Anthropic's general models by default. Cogs does not knowingly opt Customer Data into third-party general-model training.

Cogs may use feedback and user actions such as categorization confirmations, corrections, and rule changes to improve Cogs' own accounting automation. Generalized or cross-customer improvement is performed using aggregated, deidentified, or otherwise transformed information that is not reasonably linked to Customer or an identifiable individual, unless Customer separately authorizes another use or applicable law permits it.

Changes and Objections

Cogs may add or replace providers as the Service evolves. Where a contractual or legal obligation requires notice of a new subprocessor, Cogs will provide notice through the Service, email, this page, or another reasonable method.

A Customer with an applicable DPA may object to a new subprocessor on reasonable data-protection grounds as described in that DPA.

Questions may be sent to legal@getcogs.ai.

Operator: Spear America LLC, 1021 E Lincolnway, Ste 6344, Cheyenne, Wyoming 82001, United States
Service: Cogs (GetCogs.ai)
Legal contact: legal@getcogs.ai